The departmental risk profiles address a range of consequence criteria including security risks. Current best practice for security risk assessment would normally require a different methodology that includes issues around asset identification, threat identification, adversary intent and capabilities. The hospital may wish to review the methodology that they are currently using.